<html>
<head><meta charset="utf-8"><title>mitigations · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html">mitigations</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="136937149"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/136937149" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> snf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#136937149">(Nov 01 2018 at 17:38)</a>:</h4>
<p>Was there any dicussion about mitigations (specifically Control Flow Enforcement)?<br>
I've been talking to product teams here and, because of the slow adoption, these teams would start with linking Rust components with C/C++ ones. The problem now is that Rust doesn't support CFE so any binary which includes Rust code will have weakened mitigations.</p>



<a name="136937225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/136937225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#136937225">(Nov 01 2018 at 17:40)</a>:</h4>
<p>We explicitly decided to leave it out of our mission and instead focus on language-level safety, but I'm sure nobody would mind if you wanted to work on it!</p>



<a name="136938272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/136938272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> snf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#136938272">(Nov 01 2018 at 17:54)</a>:</h4>
<p>Actually that's the idea, but I wanted to know if there were any discussions about it. Thanks.</p>



<a name="136939725"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/136939725" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#136939725">(Nov 01 2018 at 18:14)</a>:</h4>
<p>np</p>



<a name="136939902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/136939902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#136939902">(Nov 01 2018 at 18:17)</a>:</h4>
<p>You're thinking about LLVM's CFI specifically?</p>



<a name="137042291"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/137042291" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> snf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#137042291">(Nov 02 2018 at 14:50)</a>:</h4>
<p>Actually I'm thinking in Windows CFI because that's my main interest and make it Visual C++ compatible. LLVM's CFI uses Intel's one which hasn't been realeased yet. Last time I checked, Clang didn't rely on LLVM's CFI neither.</p>



<a name="137048572"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/137048572" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#137048572">(Nov 02 2018 at 15:13)</a>:</h4>
<p>Err, that's not correct; LLVM's CFI is entirely software based, and it's what clang's <code>-fsanitize=cfi</code> uses. And Windows CFG requires you to compile with MSVC to have jumps in your code protected, so I don't think that's an option (you can just use a linker flag if all you need is for Rust functions to be valid CFG call targets)</p>



<a name="146787231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/146787231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> snf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#146787231">(Nov 05 2018 at 10:26)</a>:</h4>
<p>Oops, you are right about LLVM, haven't touched it in years and only saw the recent HW implementation only.<br>
However, what I'm talking about is modifying rustc and LLVM to emit information for MSVC's linker to generate fully protected binaries. I guess that mainstreaming changes like this will be challenging though.</p>



<a name="146796408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/mitigations/near/146796408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/mitigations.html#146796408">(Nov 05 2018 at 13:54)</a>:</h4>
<p>It seems that there's two steps: a) just enabling CFG at the linker, which should just be a flag, b) actually doing the codegen for checking the valid jump targets. For (b) you  probably want LLVM's CFI, not CFG (at least for fully statically linked binaries).</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>